feat(platform): prevent unscoped raw field lookups

vehicle-data-platform/apps/web/src/test/App.test.tsx

@@ -3892,6 +3892,54 @@ test('updates history hash when vehicle history filters are submitted', async ()
   }));
 });
 
+test('prevents unscoped raw parsed-field query from history form', async () => {
+  window.history.replaceState(null, '', '/#/history?keyword=VIN-SAFE-RAW');
+  const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+    const path = String(input);
+    if (path.includes('/api/ops/health')) {
+      return {
+        ok: true,
+        json: async () => ({
+          data: { linkHealth: [], kafkaLag: 0, redisOnlineKeys: 0, tdengineWritable: true, mysqlWritable: true, runtime: { requestTimeoutMs: 5000 } },
+          traceId: 'trace-test',
+          timestamp: 1783094400000
+        })
+      } as Response;
+    }
+    return {
+      ok: true,
+      json: async () => ({
+        data: { items: [], total: 0, limit: 10, offset: 0 },
+        traceId: 'trace-test',
+        timestamp: 1783094400000
+      })
+    } as Response;
+  });
+
+  render(<App />);
+
+  await screen.findByRole('heading', { name: '轨迹回放' });
+  await waitFor(() => {
+    expect(fetchMock).toHaveBeenCalledWith('/api/history/raw-frames/query', expect.objectContaining({
+      body: expect.stringContaining('VIN-SAFE-RAW')
+    }));
+  });
+  fetchMock.mockClear();
+
+  const keywordInput = screen.getByPlaceholderText('VIN / 车牌 / 手机号');
+  fireEvent.change(keywordInput, { target: { value: '' } });
+  fireEvent.input(keywordInput, { target: { value: '' } });
+  await waitFor(() => {
+    expect(keywordInput).toHaveValue('');
+  });
+  fireEvent.click(screen.getByRole('checkbox', { name: '返回解析字段' }));
+  fireEvent.click(screen.getByRole('button', { name: 'search 查询' }));
+
+  expect((await screen.findAllByText('RAW 解析字段查询需要车辆、时间范围或字段裁剪')).length).toBeGreaterThanOrEqual(1);
+  expect(fetchMock).toHaveBeenCalledWith(expect.stringContaining('/api/history/locations?'), undefined);
+  expect(fetchMock).not.toHaveBeenCalledWith('/api/history/raw-frames/query', expect.anything());
+});
+
 test('shows trajectory playback workspace from history locations', async () => {
   window.history.replaceState(null, '', '/#/history?keyword=VIN-TRACK-001&protocol=JT808');
   vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {