fix(workbench): complete profile and channel flows

backend/internal/logic/projects/service_test.go

@@ -110,6 +110,25 @@ func TestCreateProjectPersistsWorkspaceMetadata(t *testing.T) {
 	require.Equal(t, "RSS 采集和线索沉淀", workspace.Project.Description)
 }
 
+func TestCreateProjectChannelRequiresOwnedProjectAndSafeURL(t *testing.T) {
+	newTestDB(t)
+	service := NewService()
+	project, err := service.CreateProject(1, "Alpha", "")
+	require.NoError(t, err)
+
+	channel, err := service.CreateProjectChannel(1, project.ID, CreateProjectChannelInput{
+		Title: "Research", URL: "https://example.com/research",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "link", channel.Icon)
+	require.Equal(t, 1, channel.SortOrder)
+
+	_, err = service.CreateProjectChannel(1, project.ID, CreateProjectChannelInput{Title: "Unsafe", URL: "javascript:alert(1)"})
+	require.ErrorIs(t, err, ErrChannelURLInvalid)
+	_, err = service.CreateProjectChannel(2, project.ID, CreateProjectChannelInput{Title: "Foreign", URL: "https://example.com"})
+	require.ErrorIs(t, err, gorm.ErrRecordNotFound)
+}
+
 func TestWorkspaceMatchesFrontendContract(t *testing.T) {
 	database := newTestDB(t)
 	service := NewService()