read permissions on every GET

shopdb/core/api/dashboard.py

@@ -6,6 +6,7 @@ from flask_jwt_extended import jwt_required
 from shopdb.extensions import db
 from shopdb.core.models import Asset, AssetType, AssetStatus
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 dashboard_bp = Blueprint('dashboard', __name__)
 
@@ -65,7 +66,7 @@ def _countedassets():
 
 @dashboard_bp.route('/summary', methods=['GET'])
 @dashboard_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_dashboard():
     """Get dashboard summary data (asset-based)."""
     machine_count = _count_by_type('machine')
@@ -121,7 +122,7 @@ def get_dashboard():
 
 
 @dashboard_bp.route('/stats', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_stats():
     """Get detailed statistics by asset type."""
     type_counts = db.session.query(
@@ -211,7 +212,7 @@ def get_navigation():
 
 
 @dashboard_bp.route('/widgets', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_widgets():
     """Aggregate dashboard widget definitions from all enabled plugins.