read permissions on every GET

plugins/employees/api/routes.py

@@ -29,6 +29,7 @@ from shopdb.api import Setting
 from shopdb.api import send_upload
 
 from ..models import DirectoryEmployee
+from shopdb.api import require_permission
 
 logger = logging.getLogger(__name__)
 
@@ -198,6 +199,7 @@ def _with_photo_url(employee):
 
 
 @employees_bp.route('/resolve/<sso>', methods=['GET'])
+@require_permission('employees.view')
 @jwt_required()
 def resolve_employee(sso):
     """Resolve one SSO to a name and photo, and say HOW.
@@ -275,6 +277,7 @@ def resolve_employee(sso):
 
 
 @employees_bp.route('/search', methods=['GET'])
+@require_permission('employees.view')
 def search_employees():
     """
     Search employees by name.
@@ -327,6 +330,7 @@ def search_employees():
 
 
 @employees_bp.route('/lookup/<sso>', methods=['GET'])
+@require_permission('employees.view')
 def lookup_employee(sso):
     """Look up a single employee by SSO."""
     if not sso.isdigit():
@@ -370,6 +374,7 @@ def lookup_employee(sso):
 
 
 @employees_bp.route('/lookup', methods=['GET'])
+@require_permission('employees.view')
 def lookup_employees():
     """
     Look up multiple employees by SSO list.
@@ -429,7 +434,7 @@ def lookup_employees():
 # =============================================================================
 
 @employees_bp.route('/directory', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('employees.view')
 def list_directory():
     """Full self-hosted directory (for the management page)."""
     guard = _require_selfhosted()

plugins/employees/plugin.py

@@ -51,6 +51,18 @@ class EmployeesPlugin(BasePlugin):
             api_prefix=self._manifest.get('api_prefix', '/api/employees'),
         )
 
+    def get_permissions(self) -> List:
+        """Reading the staff directory.
+
+        The directory is names, SSOs, photographs and who reports to whom. It
+        was reachable with no account at all, which is how a permissions
+        question ends up answered by nobody. One read permission: the write
+        side of this plugin is an import, run from the CLI.
+        """
+        return [
+            ('employees.view', 'View the employee directory', 'employees'),
+        ]
+
     def get_blueprint(self) -> Optional[Blueprint]:
         """Return Flask Blueprint with API routes."""
         return employees_bp