From 80fcdfa1b926221b1cd8aa992b00aaf950dda7f5 Mon Sep 17 00:00:00 2001
From: "Crane.z" <1481445951@qq.com>
Date: Mon, 23 Mar 2026 10:06:04 +0800
Subject: [PATCH] fix: prevent unauthorized users from seeing PAM actions in
 asset list

---
 src/views/assets/Asset/AssetList/components/const.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/views/assets/Asset/AssetList/components/const.js b/src/views/assets/Asset/AssetList/components/const.js
index ce686fbe8..0e69e137c 100644
--- a/src/views/assets/Asset/AssetList/components/const.js
+++ b/src/views/assets/Asset/AssetList/components/const.js
@@ -245,7 +245,9 @@ export function getDefaultConfig(vm) {
               name: 'AddAccount',
               title: vm.$t('AddAccount'),
               divided: true,
-              can: ({ row }) => !vm.$store.getters.currentOrgIsRoot,
+              has: ({ row }) =>
+                !vm.$store.getters.currentOrgIsRoot &&
+                vm.$hasPerm('accounts.add_account'),
               callback: ({ row }) => {
                 vm.asset = row
                 vm.showAddDialog = true
@@ -254,7 +256,9 @@ export function getDefaultConfig(vm) {
             {
               name: 'DiscoverAccounts',
               title: vm.$t('AccountDiscover'),
-              can: ({ row }) => !vm.$store.getters.currentOrgIsRoot,
+              has: ({ row }) =>
+                !vm.$store.getters.currentOrgIsRoot &&
+                vm.$hasPerm('accounts.add_gatheraccountsexecution'),
               callback: ({ row }) => {
                 vm.discoveryDialog.asset = row.id
                 setTimeout(() => {