fix: 收藏 toggle 增加实体存在性和权限校验（IDOR 修复）

server/src/main/java/com/emotion/service/impl/EventFavoriteServiceImpl.java

@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.emotion.common.PageResult;
+import com.emotion.exception.BusinessException;
 import com.emotion.dto.response.EventFavoriteResponse;
 import com.emotion.dto.response.LifeEventResponse;
 import com.emotion.entity.EventFavorite;
@@ -49,6 +50,12 @@ public class EventFavoriteServiceImpl extends ServiceImpl<EventFavoriteMapper, E
             return r;
         }
 
+        // 验证事件存在且属于当前用户
+        LifeEventResponse event = lifeEventService.getEventById(eventId);
+        if (event == null) {
+            throw new BusinessException("事件不存在或无权限访问");
+        }
+
         LambdaQueryWrapper<EventFavorite> w = new LambdaQueryWrapper<>();
         w.eq(EventFavorite::getUserId, userId)
          .eq(EventFavorite::getEventId, eventId)

server/src/main/java/com/emotion/service/impl/ScriptFavoriteServiceImpl.java

@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.emotion.common.PageResult;
+import com.emotion.exception.BusinessException;
 import com.emotion.dto.response.EpicScriptResponse;
 import com.emotion.dto.response.ScriptFavoriteResponse;
 import com.emotion.entity.ScriptFavorite;
@@ -49,6 +50,12 @@ public class ScriptFavoriteServiceImpl extends ServiceImpl<ScriptFavoriteMapper,
             return r;
         }
 
+        // 验证剧本存在且属于当前用户
+        EpicScriptResponse script = epicScriptService.getScriptById(scriptId);
+        if (script == null) {
+            throw new BusinessException("剧本不存在或无权限访问");
+        }
+
         LambdaQueryWrapper<ScriptFavorite> w = new LambdaQueryWrapper<>();
         w.eq(ScriptFavorite::getUserId, userId)
          .eq(ScriptFavorite::getScriptId, scriptId)