{
  "scenarioId": "delete-button",
  "hiddenRisks": [
    {
      "id": "R1",
      "title": "服务端缺少权限校验",
      "severity": "critical",
      "dimensions": ["risk_ownership", "evidence_verification"],
      "surfacedBy": ["E10", "E11"],
      "description": "权限判断只在前端按钮层做了 currentUser.role === 'admin'，DELETE /api/users/bulk 没有任何服务端授权。"
    },
    {
      "id": "R2",
      "title": "硬删除可能违反业务约束",
      "severity": "critical",
      "dimensions": ["risk_ownership", "problem_framing"],
      "surfacedBy": ["E10"],
      "description": "使用 db.user.delete 直接物理删除，没有软删除字段，无法恢复。"
    },
    {
      "id": "R3",
      "title": "Promise.all 并发删除非原子",
      "severity": "critical",
      "dimensions": ["debugging", "evidence_verification"],
      "surfacedBy": ["E14", "E15"],
      "description": "Promise.all 会让每个删除独立执行，部分失败时已成功的删除无法回滚。"
    },
    {
      "id": "R4",
      "title": "没有审计日志",
      "severity": "high",
      "dimensions": ["risk_ownership"],
      "surfacedBy": ["E10"],
      "description": "删除操作没有记录操作者、时间、目标用户、原因。"
    },
    {
      "id": "R5",
      "title": "没有批量数量限制",
      "severity": "high",
      "dimensions": ["risk_ownership", "debugging"],
      "surfacedBy": ["E14"],
      "description": "传入 ids 长度没有上限，500 个用户同时删除会把 DB 连接池打满。"
    },
    {
      "id": "R6",
      "title": "测试不能证明访问控制",
      "severity": "high",
      "dimensions": ["evidence_verification"],
      "surfacedBy": ["E11"],
      "description": "18 个测试只验证 Admin UI 能看到按钮，没有直接调用 API 的非 Admin 测试。"
    },
    {
      "id": "R7",
      "title": "没有检查关联订单 / 账单",
      "severity": "high",
      "dimensions": ["problem_framing", "debugging"],
      "surfacedBy": ["E14"],
      "description": "用户被删除时未处理其名下的订单、订阅、账单，触发 FK_ORDER_OWNER 外键失败。"
    },
    {
      "id": "R8",
      "title": "没有恢复 / 回滚方案",
      "severity": "high",
      "dimensions": ["risk_ownership"],
      "surfacedBy": ["E15"],
      "description": "硬删除 + 无备份 + 无回滚演练，一旦误删无法恢复数据。"
    }
  ]
}