fix:bug

openspec/changes/update-agent-asset-action-button-permissions/specs/agent-asset-list/spec.md

@@ -0,0 +1,46 @@
+## ADDED Requirements
+
+### Requirement: Agent Asset Action Buttons SHALL Respect Session Button Permissions
+
+The agent asset list SHALL use the backend-provided button permission codes from the authenticated session to determine whether IoT card and device action buttons are rendered. The page SHALL use the following H5-specific permission-code mapping:
+
+- IoT卡停机：`asset:card_stop_h5`
+- IoT卡复机：`asset:card_start_h5`
+- 设备停机：`asset:device_stop_h5`
+- 设备复机：`asset:device_start_h5`
+
+#### Scenario: Login response returns button permission codes
+
+- **WHEN** `POST /api/auth/login` succeeds
+- **THEN** the frontend SHALL treat the response `buttons` array as the source of button-level permissions for the authenticated session
+- **AND** the session data used by the agent asset list SHALL preserve those button permission codes
+
+#### Scenario: Asset action has its mapped H5 permission code and the code is present
+
+- **WHEN** an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
+- **AND** that permission code exists in the current session `buttons` array
+- **THEN** the corresponding action button SHALL be rendered
+
+#### Scenario: Asset action has its mapped H5 permission code and the code is absent
+
+- **WHEN** an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
+- **AND** that permission code does not exist in the current session `buttons` array
+- **THEN** the corresponding action button SHALL NOT be rendered
+
+#### Scenario: Session includes only a subset of asset action permissions
+
+- **WHEN** the current session `buttons` array contains permission codes for only some of the asset actions
+- **THEN** only the matching asset action buttons SHALL be shown
+- **AND** non-matching asset action buttons SHALL remain hidden
+
+#### Scenario: Session includes unrelated button codes
+
+- **WHEN** the current session `buttons` array includes unrelated button codes such as `device:clear_series`
+- **THEN** no asset action button SHALL become visible unless its own mapped H5 permission code is also present
+
+#### Scenario: Action permissions are absent but the list item remains accessible
+
+- **WHEN** the current session does not grant any asset action button permissions for a list item
+- **THEN** the asset status text SHALL still be shown
+- **AND** the detail-page entry affordance for the list item SHALL remain available
+- **AND** the page SHALL NOT render placeholder or disabled action buttons in place of the hidden ones