refactor: unify data preparations and research input snapshots

backend/tests/test_research_workspace.py

@@ -213,7 +213,7 @@ async def test_operator_annotation_and_refresh_preserve_local(app, logged_in, re
 
 
 async def test_settings_variant_requires_all_fields_in_target(app, logged_in, research_input, catalog):
-    from app.models import CatalogScope, TemplateInput
+    from app.models import CatalogScope, ResearchInputSnapshot
     from app.research.experiments import Experiments
     from app.research.workspace_contracts import SettingVariants
 
@@ -232,14 +232,13 @@ async def test_settings_variant_requires_all_fields_in_target(app, logged_in, re
         db.add(CatalogScope(key=target_key, scope=target_scope))
         await db.flush()
         db.add(
-            TemplateInput(
+            ResearchInputSnapshot(
                 id="target",
-                scope_key=target_key,
-                dataset_id="TEST_FIN",
-                collection_version=research_input["collection_version"],
-                selection="explicit",
-                field_ids=["TEST_FIN_001"],
-                field_types={"TEST_FIN_001": "MATRIX"},
+                preparation_id="target-preparation",
+                preparation_version=1,
+                content={**{k: v for k, v in research_input.items() if k not in ("id", "preparation_id", "preparation_version", "created_at")}, "scope": target_scope,
+                         "field_ids": ["TEST_FIN_001"], "field_types": {"TEST_FIN_001": "MATRIX"},
+                         "fields": [f for f in research_input["fields"] if f["id"] == "TEST_FIN_001"]},
             )
         )
         await db.flush()
@@ -514,3 +513,16 @@ def test_real_seed_settings_preserve_execution_options_and_reject_unknowns():
     assert snapshot["startDate"] == "2014-01-01"
     with pytest.raises(ValidationError):
         seed_settings({**snapshot, "unknownOption": True})
+
+async def test_model_cannot_append_preparation_references_to_fixed_inputs(app, logged_in, research_input, monkeypatch):
+    from app.models import ResearchAsset
+    from app.research import routes
+    from app.research.workspace_contracts import FeatureSpec
+    async def model(*args):
+        return FeatureSpec(name="untrusted", hypothesis="test", input_ids=[research_input["id"]],
+            preparation_refs=[{"id": research_input["preparation_id"], "version": research_input["preparation_version"]}]), {}
+    monkeypatch.setattr(routes, "request_model", model)
+    response = await logged_in.post("/api/v1/research/generate", json={"name": "test", "hypothesis": "test", "method": "feature", "input_ids": [research_input["id"]]})
+    assert response.status_code == 422 and "不能改变" in response.text
+    async with app.state.sessions() as db:
+        assert not await db.scalar(select(ResearchAsset).where(ResearchAsset.name == "untrusted"))