修复V4来源附件URL展示脱敏

client/src/tests/reservationV4Views.spec.ts

@@ -75,6 +75,36 @@ describe('reservation V4 pages', () => {
     })
   })
 
+  it('does not render direct attachment URLs from V4 source message payload', async () => {
+    const detail = createOrderTaskDetail({
+      sourceDisplayPayload: {
+        subject: 'Booking Request',
+        sender_summary: 'guest@example.test',
+        relevant_message_excerpt: 'Please book one twin room.',
+        uploaded_media: [
+          'https://oss.example/private/booking.pdf',
+          'oss://bucket/private-voucher.jpg',
+          {
+            file_name: 'safe-booking.pdf',
+            content_type: 'application/pdf',
+          },
+        ],
+      },
+    })
+    vi.mocked(service.fetchReservationV4OrderTaskDetail).mockResolvedValue(detail)
+
+    const wrapper = await mountWithPlugins(
+      ReservationV4OrderTaskDetailView,
+      '/reservation/order-tasks/9001',
+    )
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('safe-booking.pdf')
+    expect(wrapper.text()).toContain(zhCN.conversation.unnamedAttachment)
+    expect(wrapper.text()).not.toContain('https://oss.example')
+    expect(wrapper.text()).not.toContain('oss://bucket')
+  })
+
   it('submits V4 review resolution with field_pointer overrides and confirmed order id', async () => {
     const detail = createOrderTaskDetail({
       businessCardStatus: 'REVIEW_REQUIRED',
@@ -250,10 +280,11 @@ async function mountWithPlugins(component: object, initialPath: string) {
 function createOrderTaskDetail(options: {
   businessCardStatus?: string
   businessCardAvailability?: Partial<ReservationV4TaskCardResult['availability']>
+  sourceDisplayPayload?: ReservationV4TaskCardResult['display_payload']
 } = {}): ReservationV4OrderTaskDetailResult {
   const sourceCard = createCard('card-source', 'SOURCE_MESSAGE_DISPLAY', 'READONLY', {
     fields: [],
-    display_payload: {
+    display_payload: options.sourceDisplayPayload ?? {
       subject: 'Booking Request',
       sender_summary: 'guest@example.test',
       relevant_message_excerpt: 'Please book one twin room.',