read permissions on every GET

plugins/warranty/api/routes.py

@@ -140,7 +140,7 @@ def _apply_links(warranty, assetids):
 # =============================================================================
 
 @warranty_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('warranty.view')
 def list_warranties():
     """List warranties. Filters: ?status=, ?assetid=, ?active=false."""
     query = Warranty.query
@@ -174,7 +174,7 @@ def list_warranties():
 
 
 @warranty_bp.route('/asset/<int:assetid>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('warranty.view')
 def warranties_for_asset(assetid):
     """Warranties covering one asset (for the asset-detail panel)."""
     links = WarrantyAsset.query.filter_by(assetid=assetid).all()
@@ -188,7 +188,7 @@ def warranties_for_asset(assetid):
 
 
 @warranty_bp.route('/<int:warrantyid>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('warranty.view')
 def get_warranty(warrantyid):
     warranty = db.session.get(Warranty, warrantyid)
     if not warranty:
@@ -395,7 +395,7 @@ def sync_dell():
 # =============================================================================
 
 @warranty_bp.route('/report', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('warranty.view')
 def warranty_report():
     """Counts + lists bucketed by derived status."""
     today = date.today()