read permissions on every GET

shopdb/core/api/customfields.py

@@ -15,6 +15,7 @@ from shopdb.utils.responses import (
     ErrorCodes
 )
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 customfields_bp = Blueprint('customfields', __name__)
 
@@ -45,7 +46,7 @@ def _normalize_options(raw):
 # =============================================================================
 
 @customfields_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_fields():
     """List custom-field definitions. Filter by ?assettypeid=. ?active=false
     includes inactive ones."""
@@ -171,7 +172,7 @@ def _fields_with_values(asset):
 
 
 @customfields_bp.route('/asset/<int:assetid>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_fields(assetid):
     """Active custom fields for an asset's type, merged with its values."""
     asset = db.session.get(Asset, assetid)