read permissions on every GET

plugins/printedparts/api/routes.py

@@ -542,7 +542,7 @@ def _csv_response(rows, columns, filename):
 
 
 @printedparts_bp.route('/reports/stock', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printedparts.view')
 def report_stock():
     """Stock levels with low-stock flags and the cache-vs-ledger reconcile.
 
@@ -576,7 +576,7 @@ def report_stock():
 
 
 @printedparts_bp.route('/reports/consumption', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printedparts.view')
 def report_consumption():
     """Takes per item, optionally bounded by ?days=<n> (default 30)."""
     days = request.args.get('days', 30, type=int)
@@ -604,7 +604,7 @@ def report_consumption():
 
 
 @printedparts_bp.route('/reports/by-person', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printedparts.view')
 def report_by_person():
     """Takes grouped by employee, optionally bounded by ?days=<n> (default 30)."""
     days = request.args.get('days', 30, type=int)
@@ -722,7 +722,7 @@ def upload_item_file(item_id: int):
 
 
 @printedparts_bp.route('/files/<int:file_id>/download', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printedparts.view')
 def download_item_file(file_id: int):
     """Download a revision under its original filename."""
     record = db.session.get(PrintedItemFile, file_id)