read permissions on every GET

plugins/knowledgebase/api/routes.py

@@ -77,7 +77,7 @@ def _search_clause(search):
 
 
 @knowledgebase_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('kb.view')
 def list_articles():
     """List all knowledge base articles."""
     page, per_page = get_pagination_params(request)
@@ -142,7 +142,7 @@ def list_articles():
 
 
 @knowledgebase_bp.route('/stats', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('kb.view')
 def get_stats():
     """Get knowledge base statistics."""
     # Counted over the same set the list shows. A total that includes articles
@@ -158,7 +158,7 @@ def get_stats():
 
 
 @knowledgebase_bp.route('/<int:link_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('kb.view')
 def get_article(link_id: int):
     """Get a single knowledge base article."""
     article = db.session.get(KnowledgeBase, link_id)