read permissions on every GET

shopdb/core/api/models.py

@@ -20,6 +20,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
 from shopdb.utils.uploads import send_upload
+from shopdb.utils.authz import require_permission
 
 models_bp = Blueprint('models', __name__)
 
@@ -39,7 +40,7 @@ def _modelimage_dir():
 
 
 @models_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_models():
     """List all vendor catalog models."""
     page, per_page = get_pagination_params(request)
@@ -78,7 +79,7 @@ def list_models():
 
 
 @models_bp.route('/<int:model_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_model(model_id: int):
     """Get a single model."""
     m = db.session.get(Model, model_id)
@@ -227,6 +228,7 @@ def upload_model_image(model_id: int):
 
 
 @models_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_model_image(filename):
     """Serve an uploaded model image (public - asset detail pages read it)."""
     return send_upload(_modelimage_dir(), filename)