测试：拒绝非约定前端权限门禁

shierfeng-fastapi-frontend/scripts/verify-business-contract.mjs

@@ -536,6 +536,11 @@ function parseStaticPermissionArray(expression) {
 
 function extractStaticHasPermiAnd(expression) {
   const sanitized = sanitizeSource(expression, { allowTemplateInterpolation: true })
+  assert.doesNotMatch(
+    sanitized.structure,
+    /proxy\.\$auth\.hasPermiOr\s*\(/,
+    '禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义'
+  )
   const callPattern = /proxy\.\$auth\.hasPermiAnd\s*\(/g
   const permissions = []
   let match
@@ -833,11 +838,11 @@ test('真实权限门禁解析拒绝注释常量、hasPermiOr 和动态数组假
     <script setup>const stalePermission = 'master:strain:query'</script>
   `
   assert.deepEqual(extractGuardedVuePermissions(staleSource), [])
-  assert.deepEqual(
-    extractGuardedVuePermissions(
+  assert.throws(
+    () => extractGuardedVuePermissions(
       `<button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">错误门禁</button>`
     ),
-    []
+    /hasPermiOr/
   )
   assert.throws(
     () => extractGuardedVuePermissions('<button v-hasPermi="permissionArray">动态门禁</button>'),
@@ -859,6 +864,16 @@ test('真实权限门禁解析拒绝注释常量、hasPermiOr 和动态数组假
   )
 })
 
+test('合法门禁混入额外 hasPermiOr 时直接 fail-closed', () => {
+  const source = `
+    <button v-hasPermi="['master:strain:list']">合法门禁</button>
+    <button v-if="proxy.$auth.hasPermiAnd(['master:strain:list'])">合法组合门禁</button>
+    <button v-if="proxy.$auth.hasPermiOr(['master:strain:query'])">非约定门禁</button>
+  `
+
+  assert.throws(() => extractGuardedVuePermissions(source), /hasPermiOr/)
+})
+
 test('17 个 SQL component 正好映射 17 个 page contract 普通文件', async () => {
   const componentEntries = Object.entries(expectedPageComponents)
   const pageRelativePaths = [