## ADDED Requirements

### Requirement: Agent Asset Action Buttons SHALL Respect Session Button Permissions

The agent asset list SHALL use the backend-provided button permission codes from the authenticated session to determine whether IoT card and device action buttons are rendered. The page SHALL use the following H5-specific permission-code mapping:

- IoT卡停机：`asset:card_stop_h5`
- IoT卡复机：`asset:card_start_h5`
- 设备停机：`asset:device_stop_h5`
- 设备复机：`asset:device_start_h5`

#### Scenario: Login response returns button permission codes

- **WHEN** `POST /api/auth/login` succeeds
- **THEN** the frontend SHALL treat the response `buttons` array as the source of button-level permissions for the authenticated session
- **AND** the session data used by the agent asset list SHALL preserve those button permission codes

#### Scenario: Asset action has its mapped H5 permission code and the code is present

- **WHEN** an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
- **AND** that permission code exists in the current session `buttons` array
- **THEN** the corresponding action button SHALL be rendered

#### Scenario: Asset action has its mapped H5 permission code and the code is absent

- **WHEN** an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
- **AND** that permission code does not exist in the current session `buttons` array
- **THEN** the corresponding action button SHALL NOT be rendered

#### Scenario: Session includes only a subset of asset action permissions

- **WHEN** the current session `buttons` array contains permission codes for only some of the asset actions
- **THEN** only the matching asset action buttons SHALL be shown
- **AND** non-matching asset action buttons SHALL remain hidden

#### Scenario: Session includes unrelated button codes

- **WHEN** the current session `buttons` array includes unrelated button codes such as `device:clear_series`
- **THEN** no asset action button SHALL become visible unless its own mapped H5 permission code is also present

#### Scenario: Action permissions are absent but the list item remains accessible

- **WHEN** the current session does not grant any asset action button permissions for a list item
- **THEN** the asset status text SHALL still be shown
- **AND** the detail-page entry affordance for the list item SHALL remain available
- **AND** the page SHALL NOT render placeholder or disabled action buttons in place of the hidden ones