guest role; guide section ticking

plugins/slides/api/routes.py

@@ -14,7 +14,7 @@ from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
 from shopdb.api import (db, success_response, error_response, ErrorCodes,
-                        require_permission)
+                        require_permission, require_any_permission)
 from shopdb.api import send_upload
 
 from ..models import TvSlide
@@ -90,8 +90,7 @@ def serve_image(surface, filename):
 # =============================================================================
 
 @slides_bp.route('/<surface>', methods=['GET'])
-@jwt_required()
-@require_permission('slides.manage')
+@require_any_permission('slides.view', 'slides.manage')
 def list_slides(surface):
     if not _valid_surface(surface):
         return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -108,7 +107,6 @@ def list_slides(surface):
 
 
 @slides_bp.route('/<surface>/upload', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def upload_slides(surface):
     if not _valid_surface(surface):
@@ -153,7 +151,6 @@ def upload_slides(surface):
 
 
 @slides_bp.route('/<surface>/order', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def reorder_slides(surface):
     if not _valid_surface(surface):
@@ -169,7 +166,6 @@ def reorder_slides(surface):
 
 
 @slides_bp.route('/<surface>/delete', methods=['POST'])
-@jwt_required()
 @require_permission('slides.manage')
 def delete_slides(surface):
     if not _valid_surface(surface):
@@ -195,7 +191,6 @@ def delete_slides(surface):
 
 
 @slides_bp.route('/<surface>/<int:slideid>', methods=['PATCH'])
-@jwt_required()
 @require_permission('slides.manage')
 def update_slide(surface, slideid):
     if not _valid_surface(surface):