read permissions on every GET

plugins/measuringtools/api/routes.py

@@ -49,7 +49,7 @@ def _merged(tool, today=None):
 # =============================================================================
 
 @measuringtools_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def list_types():
     """List measuring-tool types."""
     page, per_page = get_pagination_params(request)
@@ -64,7 +64,7 @@ def list_types():
 
 
 @measuringtools_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def get_type(type_id: int):
     """Get one measuring-tool type."""
     tool_type = db.session.get(MeasuringToolType, type_id)
@@ -150,7 +150,7 @@ def delete_type(type_id: int):
 # =============================================================================
 
 @measuringtools_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def list_tools():
     """List measuring tools with filters + pagination.
 
@@ -208,7 +208,7 @@ def list_tools():
 
 
 @measuringtools_bp.route('/<int:tool_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def get_tool(tool_id: int):
     """Get one measuring tool (asset core merged with the extension)."""
     tool = db.session.get(MeasuringTool, tool_id)
@@ -219,7 +219,7 @@ def get_tool(tool_id: int):
 
 
 @measuringtools_bp.route('/by-asset/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def get_tool_by_asset(asset_id: int):
     """Get a measuring tool by its core asset id."""
     tool = MeasuringTool.query.filter_by(assetid=asset_id).first()
@@ -371,7 +371,7 @@ def delete_tool(tool_id: int):
 # =============================================================================
 
 @measuringtools_bp.route('/map-overlay', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def map_overlay():
     """Calibration-status overlay for active measuring tools.
 
@@ -402,7 +402,7 @@ def map_overlay():
 # =============================================================================
 
 @measuringtools_bp.route('/report/calibration', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('measuringtools.view')
 def calibration_report():
     """Counts + lists bucketed by derived calibration status."""
     today = date.today()