read permissions on every GET

shopdb/core/api/maplevels.py

@@ -20,6 +20,7 @@ from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
 from shopdb.api import send_upload
 from shopdb.utils.imagesize import image_size
+from shopdb.utils.authz import require_permission
 
 maplevels_bp = Blueprint('maplevels', __name__)
 
@@ -38,6 +39,7 @@ def _blueprint_dir():
 # =============================================================================
 
 @maplevels_bp.route('', methods=['GET'])
+@require_permission('assets.view')
 def list_levels():
     """Every active level, grouped by building, in display order.
 
@@ -72,6 +74,7 @@ def list_levels():
 
 
 @maplevels_bp.route('/<int:levelid>', methods=['GET'])
+@require_permission('assets.view')
 def get_level(levelid):
     level = db.session.get(MapLevel, levelid)
     if not level or not level.isactive:
@@ -81,6 +84,7 @@ def get_level(levelid):
 
 
 @maplevels_bp.route('/<int:levelid>/blueprint/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_blueprint(filename, levelid=None):
     """Serve a level's blueprint image. Public, for the same reason as above."""
     return send_upload(_blueprint_dir(), filename)