read permissions on every GET

shopdb/core/api/search.py

@@ -18,6 +18,7 @@ from shopdb.core.models import (
 from shopdb.core.api.settings import get_cached_settings
 from shopdb.core.services.spellfix import Vocabulary
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 logger = logging.getLogger(__name__)
 
@@ -1161,7 +1162,7 @@ def _suggestion_for(query):
 
 
 @search_bp.route('/suggest', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def search_suggest():
     """A better spelling for a query that found nothing, or null.
 
@@ -1185,7 +1186,7 @@ def search_suggest():
 
 
 @search_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def global_search():
     """
     Global search across multiple entity types.