测试：拒绝非约定前端权限门禁

shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py

@@ -311,6 +311,8 @@ def _parse_static_permission_array(expression: str) -> list[str]:
 
 def _extract_static_has_permi_and(expression: str) -> list[str]:
     code, structure = _sanitize_vue_source(expression)
+    if re.search(r'proxy\.\$auth\.hasPermiOr\s*\(', structure):
+        raise AssertionError('禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义')
     call_tokens = list(re.finditer(r'proxy\.\$auth\.hasPermiAnd\s*\(', structure))
     call_pattern = re.compile(r'proxy\.\$auth\.hasPermiAnd\s*\(\s*(?P<array>\[[^\[\]]*\])\s*\)')
     calls = list(call_pattern.finditer(structure))
@@ -479,12 +481,20 @@ class ApiPermissionContractTest(unittest.TestCase):
             with self.subTest(source=source), self.assertRaises(AssertionError):
                 _extract_guarded_vue_permissions(source)
 
-        guarded = _extract_guarded_vue_permissions(
-            '<button v-if="proxy.$auth.hasPermiOr([\'master:strain:query\'])">错误门禁</button>'
-        )
-        self.assertEqual(frozenset(), guarded)
-        with self.assertRaises(AssertionError):
-            _assert_exact_permission_layers(self, {'vue': guarded})
+        with self.assertRaisesRegex(AssertionError, 'hasPermiOr'):
+            _extract_guarded_vue_permissions(
+                '<button v-if="proxy.$auth.hasPermiOr([\'master:strain:query\'])">错误门禁</button>'
+            )
+
+    def test_vue_guard_parser_rejects_extra_has_permi_or_after_valid_guards(self) -> None:
+        source = """
+        <button v-hasPermi="['master:strain:list']">合法门禁</button>
+        <button v-if="proxy.$auth.hasPermiAnd(['master:strain:list'])">合法组合门禁</button>
+        <button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">非约定门禁</button>
+        """
+
+        with self.assertRaisesRegex(AssertionError, 'hasPermiOr'):
+            _extract_guarded_vue_permissions(source)
 
     def test_independent_expected_permissions_reject_four_layers_missing_same_permission(self) -> None:
         missing = 'master:strain:query'

shierfeng-fastapi-frontend/scripts/verify-business-contract.mjs

@@ -536,6 +536,11 @@ function parseStaticPermissionArray(expression) {
 
 function extractStaticHasPermiAnd(expression) {
   const sanitized = sanitizeSource(expression, { allowTemplateInterpolation: true })
+  assert.doesNotMatch(
+    sanitized.structure,
+    /proxy\.\$auth\.hasPermiOr\s*\(/,
+    '禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义'
+  )
   const callPattern = /proxy\.\$auth\.hasPermiAnd\s*\(/g
   const permissions = []
   let match
@@ -833,11 +838,11 @@ test('真实权限门禁解析拒绝注释常量、hasPermiOr 和动态数组假
     <script setup>const stalePermission = 'master:strain:query'</script>
   `
   assert.deepEqual(extractGuardedVuePermissions(staleSource), [])
-  assert.deepEqual(
-    extractGuardedVuePermissions(
+  assert.throws(
+    () => extractGuardedVuePermissions(
       `<button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">错误门禁</button>`
     ),
-    []
+    /hasPermiOr/
   )
   assert.throws(
     () => extractGuardedVuePermissions('<button v-hasPermi="permissionArray">动态门禁</button>'),
@@ -859,6 +864,16 @@ test('真实权限门禁解析拒绝注释常量、hasPermiOr 和动态数组假
   )
 })
 
+test('合法门禁混入额外 hasPermiOr 时直接 fail-closed', () => {
+  const source = `
+    <button v-hasPermi="['master:strain:list']">合法门禁</button>
+    <button v-if="proxy.$auth.hasPermiAnd(['master:strain:list'])">合法组合门禁</button>
+    <button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">非约定门禁</button>
+  `
+
+  assert.throws(() => extractGuardedVuePermissions(source), /hasPermiOr/)
+})
+
 test('17 个 SQL component 正好映射 17 个 page contract 普通文件', async () => {
   const componentEntries = Object.entries(expectedPageComponents)
   const pageRelativePaths = [