read permissions on every GET

shopdb/core/api/businessunits.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 businessunits_bp = Blueprint('businessunits', __name__)
 
@@ -51,7 +52,7 @@ def list_businessunits():
 
 
 @businessunits_bp.route('/<int:bu_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_businessunit(bu_id: int):
     """Get a single business unit."""
     bu = db.session.get(BusinessUnit, bu_id)