fix: verify-asset 接口增加卡绑定设备校验

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/client_auth/service.go

@@ -106,6 +106,16 @@ func (s *Service) VerifyAsset(ctx context.Context, req *dto.VerifyAssetRequest,
 		return nil, err
 	}
 
+	// 如果是卡类型，检查是否绑定了设备
+	// TODO: resolveAsset 可返回完整卡对象以避免二次查询，后续优化
+	if assetType == assetTypeIotCard {
+		if bound, checkErr := s.checkCardBoundToDevice(ctx, assetID); checkErr != nil {
+			return nil, checkErr
+		} else if bound {
+			return nil, errors.New(errors.CodeForbidden, "该卡绑定了设备,请使用设备的虚拟号/设备号/IEMI/SN登录")
+		}
+	}
+
 	assetToken, err := s.signAssetToken(assetType, assetID)
 	if err != nil {
 		s.logger.Error("签发资产令牌失败", zap.Error(err))
@@ -596,6 +606,20 @@ func (s *Service) findOrCreateCustomer(
 	return newCustomer.ID, true, nil
 }
 
+// checkCardBoundToDevice 检查卡是否绑定了设备
+// 返回 true 表示已绑定设备，false 表示未绑定
+func (s *Service) checkCardBoundToDevice(ctx context.Context, cardID uint) (bool, error) {
+	var card model.IotCard
+	if err := s.db.WithContext(ctx).Select("is_standalone", "device_virtual_no").First(&card, cardID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return false, errors.New(errors.CodeAssetNotFound)
+		}
+		return false, errors.Wrap(errors.CodeInternalError, err, "查询卡绑定状态失败")
+	}
+	// is_standalone = false 表示已绑定设备，或者 device_virtual_no 不为空也表示已绑定
+	return !card.IsStandalone || card.DeviceVirtualNo != "", nil
+}
+
 // bindAsset 绑定客户与资产关系
 func (s *Service) bindAsset(ctx context.Context, tx *gorm.DB, customerID uint, assetType string, assetID uint) error {
 	assetKey, err := s.resolveAssetBindingKey(ctx, tx, assetType, assetID)