测试：限定前端权限门禁接收者

shierfeng-fastapi-frontend/scripts/verify-business-contract.mjs

@@ -546,7 +546,7 @@ function extractStaticHasPermiAnd(expression) {
     !permissionTokens.some((token) => token[0] === 'hasPermiOr'),
     '禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义'
   )
-  const callPattern = /proxy\.\$auth\.hasPermiAnd\s*\(/g
+  const callPattern = /(?<![\w$.])proxy\.\$auth\.hasPermiAnd\s*\(/g
   const canonicalCalls = [...sanitized.structure.matchAll(callPattern)]
   assert.equal(
     canonicalCalls.length,
@@ -911,6 +911,21 @@ test('完整合法门禁旁的非 canonical 权限调用必须 fail-closed', ()
   }
 })
 
+test('权限门禁拒绝带前缀的非 canonical proxy 接收者', () => {
+  const validGuard = `<button v-hasPermi="['master:strain:list']">合法门禁</button>`
+  const invalidCalls = [
+    `myproxy.$auth.hasPermiAnd(['master:strain:query'])`,
+    `foo.proxy.$auth.hasPermiAnd(['master:strain:query'])`,
+    `$proxy.$auth.hasPermiAnd(['master:strain:query'])`,
+    `this.proxy.$auth.hasPermiAnd(['master:strain:query'])`
+  ]
+
+  for (const invalidCall of invalidCalls) {
+    const source = `${validGuard}<button v-if="${invalidCall}">错误接收者</button>`
+    assert.throws(() => extractGuardedVuePermissions(source), /canonical/)
+  }
+})
+
 test('静态权限数组拒绝稀疏元素且仅允许单个尾逗号', () => {
   const sparseArrays = [
     `[, 'master:strain:list']`,