read permissions on every GET

plugins/notifications/api/routes.py

@@ -239,6 +239,7 @@ def _employee_picture(sso):
 # =============================================================================
 
 @notifications_bp.route('/types', methods=['GET'])
+@require_permission('notifications.view')
 def list_notification_types():
     """List all notification types."""
     page, per_page = get_pagination_params(request)
@@ -333,6 +334,7 @@ def update_notification_type(type_id: int):
 # =============================================================================
 
 @notifications_bp.route('', methods=['GET'])
+@require_permission('notifications.view')
 def list_notifications():
     """
     List all notifications with filtering and pagination.
@@ -388,6 +390,7 @@ def list_notifications():
 
 
 @notifications_bp.route('/<int:notification_id>', methods=['GET'])
+@require_permission('notifications.view')
 def get_notification(notification_id: int):
     """Get a single notification."""
     n = db.session.get(Notification, notification_id)
@@ -551,6 +554,7 @@ def delete_notification(notification_id: int):
 # =============================================================================
 
 @notifications_bp.route('/active', methods=['GET'])
+@require_permission('notifications.view')
 def get_active_notifications():
     """
     Get currently active notifications for display.
@@ -581,6 +585,7 @@ def get_active_notifications():
 
 
 @notifications_bp.route('/calendar', methods=['GET'])
+@require_permission('notifications.view')
 def get_calendar_events():
     """
     Get notifications in FullCalendar event format.
@@ -619,6 +624,7 @@ def get_calendar_events():
 
 
 @notifications_bp.route('/dashboard/summary', methods=['GET'])
+@require_permission('notifications.view')
 def dashboard_summary():
     """Get notifications dashboard summary."""
     now = datetime.now(timezone.utc).replace(tzinfo=None)
@@ -869,6 +875,7 @@ def get_shopfloor_notifications():
 
 
 @notifications_bp.route('/dashboard/active', methods=['GET'])
+@require_permission('notifications.view')
 @jwt_required()
 def dashboard_active():
     """Notifications currently showing on the floor.