fix:bug

openspec/changes/update-agent-asset-action-button-permissions/proposal.md

@@ -0,0 +1,25 @@
+# Change: Update agent asset action button permissions
+
+## Why
+
+The login response already returns button-level permission codes, but the agent asset list still renders IoT card and device action buttons without using those codes. This leaves action visibility disconnected from backend authorization and makes button exposure inconsistent with the authenticated session.
+
+## What Changes
+
+- Define agent asset-list behavior for consuming button permission codes returned from `POST /api/auth/login`
+- Require each IoT card action button and device action button in the agent asset list to be bound to an explicit H5 permission code:
+  - IoT卡停机：`asset:card_stop_h5`
+  - IoT卡复机：`asset:card_start_h5`
+  - 设备停机：`asset:device_stop_h5`
+  - 设备复机：`asset:device_start_h5`
+- Hide action buttons when the current session does not contain the corresponding permission code
+- Keep asset status text and detail-page entry visible even when action buttons are hidden
+
+## Impact
+
+- Affected specs:
+  - `agent-asset-list`
+- Affected code:
+  - `src/api/auth.ts`
+  - `src/pages/common/login/index.vue`
+  - `src/pages/agent-system/assets/index.vue`