read permissions on every GET

shopdb/core/api/locations.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 locations_bp = Blueprint('locations', __name__)
 
@@ -30,7 +31,7 @@ def _loc_type_dict(t):
 
 
 @locations_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_location_types():
     """List location types. ?active=false includes inactive ones."""
     query = LocationType.query
@@ -101,7 +102,7 @@ def delete_location_type(type_id):
 
 
 @locations_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_locations():
     """List all locations."""
     page, per_page = get_pagination_params(request)
@@ -132,7 +133,7 @@ def list_locations():
 
 
 @locations_bp.route('/<int:location_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_location(location_id: int):
     """Get a single location."""
     loc = db.session.get(Location, location_id)