read permissions on every GET

shopdb/core/api/applications.py

@@ -118,7 +118,7 @@ applications_bp = Blueprint('applications', __name__)
 
 
 @applications_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_applications():
     """List all applications."""
     page, per_page = get_pagination_params(request)
@@ -163,7 +163,7 @@ def list_applications():
 
 
 @applications_bp.route('/<int:app_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def get_application(app_id: int):
     """Get a single application with details."""
     app = db.session.get(Application, app_id)
@@ -288,7 +288,7 @@ def delete_application(app_id: int):
 # ---- Versions ----
 
 @applications_bp.route('/<int:app_id>/versions', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_versions(app_id: int):
     """List all versions for an application."""
     app = db.session.get(Application, app_id)
@@ -337,7 +337,7 @@ def create_version(app_id: int):
 # ---- Computers with this app installed ----
 
 @applications_bp.route('/<int:app_id>/installed', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_installed_machines(app_id: int):
     """List all computers that have this application installed."""
     app = db.session.get(Application, app_id)
@@ -376,7 +376,7 @@ def list_installed_machines(app_id: int):
 # ---- Installed Apps (per computer) ----
 
 @applications_bp.route('/machines/<int:machine_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_machine_applications(machine_id: int):
     """List all applications installed on a computer."""
     models, err = _require_computer_models()
@@ -541,6 +541,7 @@ def upload_application_image(app_id: int):
 
 
 @applications_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('applications.view')
 def serve_application_image(filename):
     """Serve an uploaded application image (public - lists and tiles read it)."""
     return send_upload(_appimage_dir(), filename)

shopdb/core/api/assets.py

@@ -25,7 +25,7 @@ assets_bp = Blueprint('assets', __name__)
 # =============================================================================
 
 @assets_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_asset_types():
     """List all asset types."""
     page, per_page = get_pagination_params(request)
@@ -44,7 +44,7 @@ def list_asset_types():
 
 
 @assets_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_type(type_id: int):
     """Get a single asset type."""
     t = db.session.get(AssetType, type_id)
@@ -111,7 +111,7 @@ def update_asset_type(type_id: int):
 # =============================================================================
 
 @assets_bp.route('/statuses', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_asset_statuses():
     """List all asset statuses."""
     page, per_page = get_pagination_params(request)
@@ -130,7 +130,7 @@ def list_asset_statuses():
 
 
 @assets_bp.route('/statuses/<int:status_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_status(status_id: int):
     """Get a single asset status."""
     s = db.session.get(AssetStatus, status_id)
@@ -228,7 +228,7 @@ def delete_asset_status(status_id: int):
 # =============================================================================
 
 @assets_bp.route('/relationshiptypes', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_relationship_types():
     """List all asset relationship types."""
     types = RelationshipType.query.order_by(RelationshipType.relationshiptype).all()
@@ -321,7 +321,7 @@ def delete_relationship_type(type_id: int):
 # =============================================================================
 
 @assets_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_assets():
     """
     List all assets with filtering and pagination.
@@ -407,7 +407,7 @@ def list_assets():
 
 
 @assets_bp.route('/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset(asset_id: int):
     """
     Get a single asset with full details.
@@ -551,7 +551,7 @@ def delete_asset(asset_id: int):
 
 
 @assets_bp.route('/lookup/<assetnumber>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def lookup_asset_by_number(assetnumber: str):
     """
     Look up an asset by its asset number.
@@ -672,7 +672,7 @@ def propagate_relationship(rel):
 
 
 @assets_bp.route('/<int:asset_id>/relationships', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_relationships(asset_id: int):
     """
     Get all relationships for an asset.
@@ -904,7 +904,7 @@ def delete_asset_relationship(rel_id: int):
 # =============================================================================
 
 @assets_bp.route('/map', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_assets_map():
     """
     Get all assets with map positions for unified floor map display.
@@ -1226,7 +1226,7 @@ def get_assets_map():
 
 
 @assets_bp.route('/<int:asset_id>/communications', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_communications(asset_id: int):
     """Get all communications for an asset."""
     from shopdb.core.models import Communication

shopdb/core/api/businessunits.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 businessunits_bp = Blueprint('businessunits', __name__)
 
@@ -51,7 +52,7 @@ def list_businessunits():
 
 
 @businessunits_bp.route('/<int:bu_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_businessunit(bu_id: int):
     """Get a single business unit."""
     bu = db.session.get(BusinessUnit, bu_id)

shopdb/core/api/customfields.py

@@ -15,6 +15,7 @@ from shopdb.utils.responses import (
     ErrorCodes
 )
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 customfields_bp = Blueprint('customfields', __name__)
 
@@ -45,7 +46,7 @@ def _normalize_options(raw):
 # =============================================================================
 
 @customfields_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_fields():
     """List custom-field definitions. Filter by ?assettypeid=. ?active=false
     includes inactive ones."""
@@ -171,7 +172,7 @@ def _fields_with_values(asset):
 
 
 @customfields_bp.route('/asset/<int:assetid>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_fields(assetid):
     """Active custom fields for an asset's type, merged with its values."""
     asset = db.session.get(Asset, assetid)

shopdb/core/api/dashboard.py

@@ -6,6 +6,7 @@ from flask_jwt_extended import jwt_required
 from shopdb.extensions import db
 from shopdb.core.models import Asset, AssetType, AssetStatus
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 dashboard_bp = Blueprint('dashboard', __name__)
 
@@ -65,7 +66,7 @@ def _countedassets():
 
 @dashboard_bp.route('/summary', methods=['GET'])
 @dashboard_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_dashboard():
     """Get dashboard summary data (asset-based)."""
     machine_count = _count_by_type('machine')
@@ -121,7 +122,7 @@ def get_dashboard():
 
 
 @dashboard_bp.route('/stats', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_stats():
     """Get detailed statistics by asset type."""
     type_counts = db.session.query(
@@ -211,7 +212,7 @@ def get_navigation():
 
 
 @dashboard_bp.route('/widgets', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_widgets():
     """Aggregate dashboard widget definitions from all enabled plugins.
 

shopdb/core/api/dashboarddefaults.py

@@ -13,6 +13,7 @@ from shopdb.core.models.dashboarddefault import (
     DISPLAY_ROLES, DISPLAY_ROLE_PATHS, normalize_display_role)
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__)
 
@@ -102,7 +103,7 @@ def display_role():
 
 
 @dashboarddefaults_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('settings.view')
 def list_defaults():
     """List all visitor-IP -> business-unit mappings."""
     defaults = DashboardDefault.query.filter_by(isactive=True).order_by(

shopdb/core/api/locations.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 locations_bp = Blueprint('locations', __name__)
 
@@ -30,7 +31,7 @@ def _loc_type_dict(t):
 
 
 @locations_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_location_types():
     """List location types. ?active=false includes inactive ones."""
     query = LocationType.query
@@ -101,7 +102,7 @@ def delete_location_type(type_id):
 
 
 @locations_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_locations():
     """List all locations."""
     page, per_page = get_pagination_params(request)
@@ -132,7 +133,7 @@ def list_locations():
 
 
 @locations_bp.route('/<int:location_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_location(location_id: int):
     """Get a single location."""
     loc = db.session.get(Location, location_id)

shopdb/core/api/maplevels.py

@@ -20,6 +20,7 @@ from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
 from shopdb.api import send_upload
 from shopdb.utils.imagesize import image_size
+from shopdb.utils.authz import require_permission
 
 maplevels_bp = Blueprint('maplevels', __name__)
 
@@ -38,6 +39,7 @@ def _blueprint_dir():
 # =============================================================================
 
 @maplevels_bp.route('', methods=['GET'])
+@require_permission('assets.view')
 def list_levels():
     """Every active level, grouped by building, in display order.
 
@@ -72,6 +74,7 @@ def list_levels():
 
 
 @maplevels_bp.route('/<int:levelid>', methods=['GET'])
+@require_permission('assets.view')
 def get_level(levelid):
     level = db.session.get(MapLevel, levelid)
     if not level or not level.isactive:
@@ -81,6 +84,7 @@ def get_level(levelid):
 
 
 @maplevels_bp.route('/<int:levelid>/blueprint/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_blueprint(filename, levelid=None):
     """Serve a level's blueprint image. Public, for the same reason as above."""
     return send_upload(_blueprint_dir(), filename)

shopdb/core/api/models.py

@@ -20,6 +20,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
 from shopdb.utils.uploads import send_upload
+from shopdb.utils.authz import require_permission
 
 models_bp = Blueprint('models', __name__)
 
@@ -39,7 +40,7 @@ def _modelimage_dir():
 
 
 @models_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_models():
     """List all vendor catalog models."""
     page, per_page = get_pagination_params(request)
@@ -78,7 +79,7 @@ def list_models():
 
 
 @models_bp.route('/<int:model_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_model(model_id: int):
     """Get a single model."""
     m = db.session.get(Model, model_id)
@@ -227,6 +228,7 @@ def upload_model_image(model_id: int):
 
 
 @models_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_model_image(filename):
     """Serve an uploaded model image (public - asset detail pages read it)."""
     return send_upload(_modelimage_dir(), filename)

shopdb/core/api/modeltypes.py

@@ -19,12 +19,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 modeltypes_bp = Blueprint('modeltypes', __name__)
 
 
 @modeltypes_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_modeltypes():
     """List all model types with optional filtering."""
     page, per_page = get_pagination_params(request)
@@ -53,7 +54,7 @@ def list_modeltypes():
 
 
 @modeltypes_bp.route('/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_modeltype(type_id: int):
     """Get a single model type."""
     mt = db.session.get(ModelType, type_id)

shopdb/core/api/operatingsystems.py

@@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 operatingsystems_bp = Blueprint('operatingsystems', __name__)
 
 
 @operatingsystems_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_operatingsystems():
     """List all operating systems."""
     page, per_page = get_pagination_params(request)
@@ -49,7 +50,7 @@ def list_operatingsystems():
 
 
 @operatingsystems_bp.route('/<int:os_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_operatingsystem(os_id: int):
     """Get a single operating system."""
     os = db.session.get(OperatingSystem, os_id)

shopdb/core/api/plugins.py

@@ -6,12 +6,13 @@ from flask_jwt_extended import jwt_required
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 plugins_bp = Blueprint('plugins', __name__)
 
 
 @plugins_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('settings.view')
 def list_plugins():
     """List all discovered plugins (enabled or not) with their metadata and
     the framework contract version."""

shopdb/core/api/pluginui.py

@@ -15,6 +15,7 @@ from flask_jwt_extended import jwt_required
 from shopdb.extensions import db
 from shopdb.core.models import Asset
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
+from shopdb.utils.authz import require_permission
 
 pluginui_bp = Blueprint('pluginui', __name__)
 
@@ -47,7 +48,7 @@ def _collect(hookname):
 
 
 @pluginui_bp.route('/settings-cards', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def settings_cards():
     """Merge enabled plugins' settings-catalog cards (get_settings_cards hook).
 
@@ -60,7 +61,7 @@ def settings_cards():
 
 
 @pluginui_bp.route('/asset-panels', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def asset_panels():
     """Return the asset-detail panels matching one asset's type (get_asset_panels).
 
@@ -86,7 +87,7 @@ def asset_panels():
 
 
 @pluginui_bp.route('/map-overlays', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def map_overlays():
     """Merge enabled plugins' map overlay declarations (get_map_overlays hook).
 
@@ -98,7 +99,7 @@ def map_overlays():
 
 
 @pluginui_bp.route('/asset-presentation', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def asset_presentation():
     """Merge enabled plugins' asset-type presentation entries (hook).
 

shopdb/core/api/reports.py

@@ -32,7 +32,7 @@ def generate_csv(data: list, columns: list) -> str:
 # =============================================================================
 
 @reports_bp.route('/machines-by-type', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def machines_by_type():
     """
     Report: Machine count grouped by machine type.
@@ -107,7 +107,7 @@ def machines_by_type():
 # =============================================================================
 
 @reports_bp.route('/assets-by-status', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def assets_by_status():
     """
     Report: Asset count grouped by status.
@@ -166,7 +166,7 @@ def assets_by_status():
 # =============================================================================
 
 @reports_bp.route('/kb-popularity', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def kb_popularity():
     """
     Report: Most clicked knowledge base articles.
@@ -223,7 +223,7 @@ def kb_popularity():
 # =============================================================================
 
 @reports_bp.route('/software-compliance', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def software_compliance():
     """
     Report: Required applications vs installed (per PC).
@@ -342,7 +342,7 @@ def software_compliance():
 # =============================================================================
 
 @reports_bp.route('/asset-inventory', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def asset_inventory():
     """
     Report: Complete asset inventory summary.
@@ -456,7 +456,7 @@ def asset_inventory():
 # =============================================================================
 
 @reports_bp.route('/pc-relationships', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def pc_relationships():
     """
     Report: PCs with relationships to shop floor machines.
@@ -573,7 +573,7 @@ def email_report():
 
 
 @reports_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def list_reports():
     """List all available reports."""
     reports = [

shopdb/core/api/search.py

@@ -18,6 +18,7 @@ from shopdb.core.models import (
 from shopdb.core.api.settings import get_cached_settings
 from shopdb.core.services.spellfix import Vocabulary
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 logger = logging.getLogger(__name__)
 
@@ -1161,7 +1162,7 @@ def _suggestion_for(query):
 
 
 @search_bp.route('/suggest', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def search_suggest():
     """A better spelling for a query that found nothing, or null.
 
@@ -1185,7 +1186,7 @@ def search_suggest():
 
 
 @search_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def global_search():
     """
     Global search across multiple entity types.

shopdb/core/api/supportteams.py

@@ -14,12 +14,13 @@ from shopdb.utils.responses import (
 )
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 supportteams_bp = Blueprint('supportteams', __name__)
 
 
 @supportteams_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_support_teams():
     """List support teams (with contacts). ?active and ?teamname filters."""
     query = SupportTeam.query
@@ -36,7 +37,7 @@ def list_support_teams():
 
 
 @supportteams_bp.route('/<int:team_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_support_team(team_id: int):
     """Get a single support team with its contacts."""
     team = db.session.get(SupportTeam, team_id)

shopdb/core/api/vendors.py

@@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 vendors_bp = Blueprint('vendors', __name__)
 
 
 @vendors_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_vendors():
     """List all vendors."""
     page, per_page = get_pagination_params(request)
@@ -46,7 +47,7 @@ def list_vendors():
 
 
 @vendors_bp.route('/<int:vendor_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_vendor(vendor_id: int):
     """Get a single vendor."""
     v = db.session.get(Vendor, vendor_id)