read permissions on every GET

plugins/employees/api/routes.py

@@ -29,6 +29,7 @@ from shopdb.api import Setting
 from shopdb.api import send_upload
 
 from ..models import DirectoryEmployee
+from shopdb.api import require_permission
 
 logger = logging.getLogger(__name__)
 
@@ -198,6 +199,7 @@ def _with_photo_url(employee):
 
 
 @employees_bp.route('/resolve/<sso>', methods=['GET'])
+@require_permission('employees.view')
 @jwt_required()
 def resolve_employee(sso):
     """Resolve one SSO to a name and photo, and say HOW.
@@ -275,6 +277,7 @@ def resolve_employee(sso):
 
 
 @employees_bp.route('/search', methods=['GET'])
+@require_permission('employees.view')
 def search_employees():
     """
     Search employees by name.
@@ -327,6 +330,7 @@ def search_employees():
 
 
 @employees_bp.route('/lookup/<sso>', methods=['GET'])
+@require_permission('employees.view')
 def lookup_employee(sso):
     """Look up a single employee by SSO."""
     if not sso.isdigit():
@@ -370,6 +374,7 @@ def lookup_employee(sso):
 
 
 @employees_bp.route('/lookup', methods=['GET'])
+@require_permission('employees.view')
 def lookup_employees():
     """
     Look up multiple employees by SSO list.
@@ -429,7 +434,7 @@ def lookup_employees():
 # =============================================================================
 
 @employees_bp.route('/directory', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('employees.view')
 def list_directory():
     """Full self-hosted directory (for the management page)."""
     guard = _require_selfhosted()