read permissions on every GET

shopdb/utils/authz.py

@@ -133,6 +133,9 @@ def require_permission(permission_name: str):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        # Named so a test can sweep the URL map and prove every read is gated;
+        # a decorator is invisible from the outside otherwise.
+        wrapper._requires_permission = (permission_name,)
         return wrapper
     return decorator
 
@@ -180,6 +183,7 @@ def require_any_permission(*permission_names):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        wrapper._requires_permission = tuple(permission_names)
         return wrapper
     return decorator
 
@@ -215,5 +219,7 @@ def require_role(rolename: str):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        # A role gate is a gate too, as far as the read sweep is concerned.
+        wrapper._requires_permission = ('role:' + rolename,)
         return wrapper
     return decorator