测试：拒绝非约定前端权限门禁

shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py

@@ -311,6 +311,8 @@ def _parse_static_permission_array(expression: str) -> list[str]:
 
 def _extract_static_has_permi_and(expression: str) -> list[str]:
     code, structure = _sanitize_vue_source(expression)
+    if re.search(r'proxy\.\$auth\.hasPermiOr\s*\(', structure):
+        raise AssertionError('禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义')
     call_tokens = list(re.finditer(r'proxy\.\$auth\.hasPermiAnd\s*\(', structure))
     call_pattern = re.compile(r'proxy\.\$auth\.hasPermiAnd\s*\(\s*(?P<array>\[[^\[\]]*\])\s*\)')
     calls = list(call_pattern.finditer(structure))
@@ -479,12 +481,20 @@ class ApiPermissionContractTest(unittest.TestCase):
             with self.subTest(source=source), self.assertRaises(AssertionError):
                 _extract_guarded_vue_permissions(source)
 
-        guarded = _extract_guarded_vue_permissions(
-            '<button v-if="proxy.$auth.hasPermiOr([\'master:strain:query\'])">错误门禁</button>'
-        )
-        self.assertEqual(frozenset(), guarded)
-        with self.assertRaises(AssertionError):
-            _assert_exact_permission_layers(self, {'vue': guarded})
+        with self.assertRaisesRegex(AssertionError, 'hasPermiOr'):
+            _extract_guarded_vue_permissions(
+                '<button v-if="proxy.$auth.hasPermiOr([\'master:strain:query\'])">错误门禁</button>'
+            )
+
+    def test_vue_guard_parser_rejects_extra_has_permi_or_after_valid_guards(self) -> None:
+        source = """
+        <button v-hasPermi="['master:strain:list']">合法门禁</button>
+        <button v-if="proxy.$auth.hasPermiAnd(['master:strain:list'])">合法组合门禁</button>
+        <button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">非约定门禁</button>
+        """
+
+        with self.assertRaisesRegex(AssertionError, 'hasPermiOr'):
+            _extract_guarded_vue_permissions(source)
 
     def test_independent_expected_permissions_reject_four_layers_missing_same_permission(self) -> None:
         missing = 'master:strain:query'