测试：收紧前端权限与组件契约

shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py

@@ -311,9 +311,12 @@ def _parse_static_permission_array(expression: str) -> list[str]:
 
 def _extract_static_has_permi_and(expression: str) -> list[str]:
     code, structure = _sanitize_vue_source(expression)
-    if re.search(r'proxy\.\$auth\.hasPermiOr\s*\(', structure):
+    permission_tokens = list(re.finditer(r'\bhasPermi(?:And|Or)\b', structure))
+    if any(token.group(0) == 'hasPermiOr' for token in permission_tokens):
         raise AssertionError('禁止使用 proxy.$auth.hasPermiOr，权限门禁必须使用约定的静态 AND 语义')
     call_tokens = list(re.finditer(r'proxy\.\$auth\.hasPermiAnd\s*\(', structure))
+    if len(permission_tokens) != len(call_tokens):
+        raise AssertionError('hasPermiAnd 必须使用 canonical proxy.$auth.hasPermiAnd(static-array) 形式')
     call_pattern = re.compile(r'proxy\.\$auth\.hasPermiAnd\s*\(\s*(?P<array>\[[^\[\]]*\])\s*\)')
     calls = list(call_pattern.finditer(structure))
     if len(calls) != len(call_tokens):
@@ -496,6 +499,24 @@ class ApiPermissionContractTest(unittest.TestCase):
         with self.assertRaisesRegex(AssertionError, 'hasPermiOr'):
             _extract_guarded_vue_permissions(source)
 
+    def test_vue_guard_parser_rejects_noncanonical_permission_calls(self) -> None:
+        valid_guard = '<button v-hasPermi="[\'master:strain:list\']">合法门禁</button>'
+        invalid_calls = (
+            "proxy . $auth . hasPermiOr(['master:strain:query'])",
+            'proxy?.$auth?.hasPermiAnd(permissionArray)',
+            "proxy['$auth'].hasPermiOr(['master:strain:query'])",
+        )
+        for invalid_call in invalid_calls:
+            source = f'{valid_guard}<button v-if="{invalid_call}">非约定门禁</button>'
+            with (
+                self.subTest(invalid_call=invalid_call),
+                self.assertRaisesRegex(
+                    AssertionError,
+                    'hasPermi|canonical',
+                ),
+            ):
+                _extract_guarded_vue_permissions(source)
+
     def test_independent_expected_permissions_reject_four_layers_missing_same_permission(self) -> None:
         missing = 'master:strain:query'
         mutated = EXPECTED_PERMISSIONS - {missing}