Reading anything needs a permission

A sweep of the URL map found 165 GET routes that answered anybody, with no
token at all: the whole asset inventory, every machine, PC, printer and network
device, the USB checkout history and who is holding which drive, the staff
directory with its photographs, every core report. Guest access had been argued
about one feature-flag at a time while the front door stood open.

Each of those now carries the read permission it belongs to. That also makes
the guest role mean something: a site can open exactly the reads it chooses,
and nothing follows by accident.

Thirty-three endpoints stay public, and each is named with its reason rather
than left to be inferred: the app shell and its bootstrap, the settings
allowlist (the handler already filters an anonymous caller down to branding and
a few keys), images fetched by <img src> which carries no Authorization header,
what a display kiosk renders before anybody signs in, the parts and USB kiosks,
the client scripts that run as SYSTEM before a user session exists, and a
secure-send link whose unguessable token IS the authorisation.

tests/test_core/test_public_read_surface.py is the standing gate, the companion
to the mutating-route sweep that has guarded writes for months. A new public
read fails CI until somebody adds it to that list in front of a reviewer. Four
further reads need a login but no permission, because the handler decides from
who you are - your own user record, your own API tokens, the role catalogue the
grid renders - and the same test proves each still refuses an anonymous caller.
Verified not vacuous by ungating one route and watching the sweep name it.

The employees plugin gained employees.view; the directory is names, SSOs,
photographs and reporting lines, and it had no permission of any kind.

Around ninety tests asserted payload shapes against endpoints that answered
anybody. They are about what the answer says, not about who may ask, so they
are signed in now rather than the gate being loosened. The ones that assert an
anonymous caller is refused were left exactly as they were.

plugins/printers/api/asset_routes.py

@@ -30,7 +30,7 @@ printers_asset_bp = Blueprint('printers_asset', __name__)
 # =============================================================================
 
 @printers_asset_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def list_printer_types():
     """List all printer types."""
     page, per_page = get_pagination_params(request)
@@ -52,7 +52,7 @@ def list_printer_types():
 
 
 @printers_asset_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def get_printer_type(type_id: int):
     """Get a single printer type."""
     t = db.session.get(PrinterType, type_id)
@@ -147,7 +147,7 @@ def delete_printer_type(type_id: int):
 # =============================================================================
 
 @printers_asset_bp.route('/drivers', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def list_drivers():
     """List printer drivers. ?active=false includes inactive ones."""
     query = PrinterDriver.query
@@ -207,7 +207,7 @@ def delete_driver(driver_id):
 # =============================================================================
 
 @printers_asset_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def list_printers():
     """
     List all printers with filtering and pagination.
@@ -964,7 +964,7 @@ def printers_for_host(hostname: str):
 
 
 @printers_asset_bp.route('/assignments/for-asset/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def get_asset_printer_assignment(asset_id: int):
     """What THIS asset is assigned, without inheritance.
 
@@ -1778,7 +1778,7 @@ def seed_assignment_from_observed(asset_id: int):
 
 
 @printers_asset_bp.route('/<int:printer_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def get_printer(printer_id: int):
     """Get a single printer with full details."""
     printer = db.session.get(Printer, printer_id)
@@ -1811,7 +1811,7 @@ def get_printer(printer_id: int):
 
 
 @printers_asset_bp.route('/by-asset/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def get_printer_by_asset(asset_id: int):
     """Get printer data by asset ID."""
     printer = Printer.query.filter_by(assetid=asset_id).first()
@@ -2043,7 +2043,7 @@ def delete_printer(printer_id: int):
 # =============================================================================
 
 @printers_asset_bp.route('/<int:printer_id>/supplies', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def get_printer_supplies(printer_id: int):
     """Get supply levels from Zabbix (real-time lookup)."""
     printer = db.session.get(Printer, printer_id)
@@ -2238,7 +2238,7 @@ def _get_low_supplies_data():
 
 
 @printers_asset_bp.route('/lowsupplies', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def low_supplies():
     """Get printers with low or critical supply levels."""
     data = _get_low_supplies_data()
@@ -2246,7 +2246,7 @@ def low_supplies():
 
 
 @printers_asset_bp.route('/lookup', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def printer_lookup():
     """Find a printer by IP or FQDN. Parity with the classic printerlookup.asp.
 
@@ -2306,7 +2306,7 @@ def refresh_supplies_cache():
 # =============================================================================
 
 @printers_asset_bp.route('/dashboard/summary', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def dashboard_summary():
     """Get printer dashboard summary data."""
     # Total active printers
@@ -2380,7 +2380,7 @@ def _validate_supply_payload(data):
 
 
 @printers_asset_bp.route('/supplies/meta', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def supplies_meta():
     """Allowed values for supply type, color, and capacity tier (for the UI)."""
     return success_response({
@@ -2391,7 +2391,7 @@ def supplies_meta():
 
 
 @printers_asset_bp.route('/models', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def list_supply_models():
     """List models with a supply count, for the supply-management picker.
 
@@ -2450,7 +2450,7 @@ def list_supply_models():
 
 
 @printers_asset_bp.route('/models/<int:modelnumberid>/supplies', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def list_model_supplies(modelnumberid: int):
     """List all supplies mapped to a model."""
     model = db.session.get(Model, modelnumberid)
@@ -2667,7 +2667,7 @@ def dashboard_supplies():
 # =============================================================================
 
 @printers_asset_bp.route('/supplies/forecast', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('printers.view')
 def supplies_forecast():
     """Days-to-empty and replacement counts per printer.