gt-agent-company/openspec/changes/update-agent-asset-action-button-permissions/specs/agent-asset-list/spec.md

ADDED Requirements

Requirement: Agent Asset Action Buttons SHALL Respect Session Button Permissions

The agent asset list SHALL use the backend-provided button permission codes from the authenticated session to determine whether IoT card and device action buttons are rendered. The page SHALL use the following H5-specific permission-code mapping:

• IoT卡停机：asset:card_stop_h5
• IoT卡复机：asset:card_start_h5
• 设备停机：asset:device_stop_h5
• 设备复机：asset:device_start_h5

Scenario: Login response returns button permission codes

• WHEN POST /api/auth/login succeeds
• THEN the frontend SHALL treat the response buttons array as the source of button-level permissions for the authenticated session
• AND the session data used by the agent asset list SHALL preserve those button permission codes

Scenario: Asset action has its mapped H5 permission code and the code is present

• WHEN an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
• AND that permission code exists in the current session buttons array
• THEN the corresponding action button SHALL be rendered

Scenario: Asset action has its mapped H5 permission code and the code is absent

• WHEN an IoT card or device action button in the agent asset list has one of the mapped H5 permission codes
• AND that permission code does not exist in the current session buttons array
• THEN the corresponding action button SHALL NOT be rendered

Scenario: Session includes only a subset of asset action permissions

• WHEN the current session buttons array contains permission codes for only some of the asset actions
• THEN only the matching asset action buttons SHALL be shown
• AND non-matching asset action buttons SHALL remain hidden

Scenario: Session includes unrelated button codes

• WHEN the current session buttons array includes unrelated button codes such as device:clear_series
• THEN no asset action button SHALL become visible unless its own mapped H5 permission code is also present

Scenario: Action permissions are absent but the list item remains accessible

• WHEN the current session does not grant any asset action button permissions for a list item
• THEN the asset status text SHALL still be shown
• AND the detail-page entry affordance for the list item SHALL remain available
• AND the page SHALL NOT render placeholder or disabled action buttons in place of the hidden ones