read permissions on every GET

shopdb/core/api/applications.py

@@ -118,7 +118,7 @@ applications_bp = Blueprint('applications', __name__)
 
 
 @applications_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_applications():
     """List all applications."""
     page, per_page = get_pagination_params(request)
@@ -163,7 +163,7 @@ def list_applications():
 
 
 @applications_bp.route('/<int:app_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def get_application(app_id: int):
     """Get a single application with details."""
     app = db.session.get(Application, app_id)
@@ -288,7 +288,7 @@ def delete_application(app_id: int):
 # ---- Versions ----
 
 @applications_bp.route('/<int:app_id>/versions', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_versions(app_id: int):
     """List all versions for an application."""
     app = db.session.get(Application, app_id)
@@ -337,7 +337,7 @@ def create_version(app_id: int):
 # ---- Computers with this app installed ----
 
 @applications_bp.route('/<int:app_id>/installed', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_installed_machines(app_id: int):
     """List all computers that have this application installed."""
     app = db.session.get(Application, app_id)
@@ -376,7 +376,7 @@ def list_installed_machines(app_id: int):
 # ---- Installed Apps (per computer) ----
 
 @applications_bp.route('/machines/<int:machine_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_machine_applications(machine_id: int):
     """List all applications installed on a computer."""
     models, err = _require_computer_models()
@@ -541,6 +541,7 @@ def upload_application_image(app_id: int):
 
 
 @applications_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('applications.view')
 def serve_application_image(filename):
     """Serve an uploaded application image (public - lists and tiles read it)."""
     return send_upload(_appimage_dir(), filename)