Reading anything needs a permission

A sweep of the URL map found 165 GET routes that answered anybody, with no
token at all: the whole asset inventory, every machine, PC, printer and network
device, the USB checkout history and who is holding which drive, the staff
directory with its photographs, every core report. Guest access had been argued
about one feature-flag at a time while the front door stood open.

Each of those now carries the read permission it belongs to. That also makes
the guest role mean something: a site can open exactly the reads it chooses,
and nothing follows by accident.

Thirty-three endpoints stay public, and each is named with its reason rather
than left to be inferred: the app shell and its bootstrap, the settings
allowlist (the handler already filters an anonymous caller down to branding and
a few keys), images fetched by <img src> which carries no Authorization header,
what a display kiosk renders before anybody signs in, the parts and USB kiosks,
the client scripts that run as SYSTEM before a user session exists, and a
secure-send link whose unguessable token IS the authorisation.

tests/test_core/test_public_read_surface.py is the standing gate, the companion
to the mutating-route sweep that has guarded writes for months. A new public
read fails CI until somebody adds it to that list in front of a reviewer. Four
further reads need a login but no permission, because the handler decides from
who you are - your own user record, your own API tokens, the role catalogue the
grid renders - and the same test proves each still refuses an anonymous caller.
Verified not vacuous by ungating one route and watching the sweep name it.

The employees plugin gained employees.view; the directory is names, SSOs,
photographs and reporting lines, and it had no permission of any kind.

Around ninety tests asserted payload shapes against endpoints that answered
anybody. They are about what the answer says, not about who may ask, so they
are signed in now rather than the gate being loosened. The ones that assert an
anonymous caller is refused were left exactly as they were.

shopdb/core/api/applications.py

@@ -118,7 +118,7 @@ applications_bp = Blueprint('applications', __name__)
 
 
 @applications_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_applications():
     """List all applications."""
     page, per_page = get_pagination_params(request)
@@ -163,7 +163,7 @@ def list_applications():
 
 
 @applications_bp.route('/<int:app_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def get_application(app_id: int):
     """Get a single application with details."""
     app = db.session.get(Application, app_id)
@@ -288,7 +288,7 @@ def delete_application(app_id: int):
 # ---- Versions ----
 
 @applications_bp.route('/<int:app_id>/versions', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_versions(app_id: int):
     """List all versions for an application."""
     app = db.session.get(Application, app_id)
@@ -337,7 +337,7 @@ def create_version(app_id: int):
 # ---- Computers with this app installed ----
 
 @applications_bp.route('/<int:app_id>/installed', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_installed_machines(app_id: int):
     """List all computers that have this application installed."""
     app = db.session.get(Application, app_id)
@@ -376,7 +376,7 @@ def list_installed_machines(app_id: int):
 # ---- Installed Apps (per computer) ----
 
 @applications_bp.route('/machines/<int:machine_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('applications.view')
 def list_machine_applications(machine_id: int):
     """List all applications installed on a computer."""
     models, err = _require_computer_models()
@@ -541,6 +541,7 @@ def upload_application_image(app_id: int):
 
 
 @applications_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('applications.view')
 def serve_application_image(filename):
     """Serve an uploaded application image (public - lists and tiles read it)."""
     return send_upload(_appimage_dir(), filename)

shopdb/core/api/assets.py

@@ -25,7 +25,7 @@ assets_bp = Blueprint('assets', __name__)
 # =============================================================================
 
 @assets_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_asset_types():
     """List all asset types."""
     page, per_page = get_pagination_params(request)
@@ -44,7 +44,7 @@ def list_asset_types():
 
 
 @assets_bp.route('/types/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_type(type_id: int):
     """Get a single asset type."""
     t = db.session.get(AssetType, type_id)
@@ -111,7 +111,7 @@ def update_asset_type(type_id: int):
 # =============================================================================
 
 @assets_bp.route('/statuses', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_asset_statuses():
     """List all asset statuses."""
     page, per_page = get_pagination_params(request)
@@ -130,7 +130,7 @@ def list_asset_statuses():
 
 
 @assets_bp.route('/statuses/<int:status_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_status(status_id: int):
     """Get a single asset status."""
     s = db.session.get(AssetStatus, status_id)
@@ -228,7 +228,7 @@ def delete_asset_status(status_id: int):
 # =============================================================================
 
 @assets_bp.route('/relationshiptypes', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_relationship_types():
     """List all asset relationship types."""
     types = RelationshipType.query.order_by(RelationshipType.relationshiptype).all()
@@ -321,7 +321,7 @@ def delete_relationship_type(type_id: int):
 # =============================================================================
 
 @assets_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_assets():
     """
     List all assets with filtering and pagination.
@@ -407,7 +407,7 @@ def list_assets():
 
 
 @assets_bp.route('/<int:asset_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset(asset_id: int):
     """
     Get a single asset with full details.
@@ -551,7 +551,7 @@ def delete_asset(asset_id: int):
 
 
 @assets_bp.route('/lookup/<assetnumber>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def lookup_asset_by_number(assetnumber: str):
     """
     Look up an asset by its asset number.
@@ -672,7 +672,7 @@ def propagate_relationship(rel):
 
 
 @assets_bp.route('/<int:asset_id>/relationships', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_relationships(asset_id: int):
     """
     Get all relationships for an asset.
@@ -904,7 +904,7 @@ def delete_asset_relationship(rel_id: int):
 # =============================================================================
 
 @assets_bp.route('/map', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_assets_map():
     """
     Get all assets with map positions for unified floor map display.
@@ -1226,7 +1226,7 @@ def get_assets_map():
 
 
 @assets_bp.route('/<int:asset_id>/communications', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_communications(asset_id: int):
     """Get all communications for an asset."""
     from shopdb.core.models import Communication

shopdb/core/api/businessunits.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 businessunits_bp = Blueprint('businessunits', __name__)
 
@@ -51,7 +52,7 @@ def list_businessunits():
 
 
 @businessunits_bp.route('/<int:bu_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_businessunit(bu_id: int):
     """Get a single business unit."""
     bu = db.session.get(BusinessUnit, bu_id)

shopdb/core/api/customfields.py

@@ -15,6 +15,7 @@ from shopdb.utils.responses import (
     ErrorCodes
 )
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 customfields_bp = Blueprint('customfields', __name__)
 
@@ -45,7 +46,7 @@ def _normalize_options(raw):
 # =============================================================================
 
 @customfields_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_fields():
     """List custom-field definitions. Filter by ?assettypeid=. ?active=false
     includes inactive ones."""
@@ -171,7 +172,7 @@ def _fields_with_values(asset):
 
 
 @customfields_bp.route('/asset/<int:assetid>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_asset_fields(assetid):
     """Active custom fields for an asset's type, merged with its values."""
     asset = db.session.get(Asset, assetid)

shopdb/core/api/dashboard.py

@@ -6,6 +6,7 @@ from flask_jwt_extended import jwt_required
 from shopdb.extensions import db
 from shopdb.core.models import Asset, AssetType, AssetStatus
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 dashboard_bp = Blueprint('dashboard', __name__)
 
@@ -65,7 +66,7 @@ def _countedassets():
 
 @dashboard_bp.route('/summary', methods=['GET'])
 @dashboard_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_dashboard():
     """Get dashboard summary data (asset-based)."""
     machine_count = _count_by_type('machine')
@@ -121,7 +122,7 @@ def get_dashboard():
 
 
 @dashboard_bp.route('/stats', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_stats():
     """Get detailed statistics by asset type."""
     type_counts = db.session.query(
@@ -211,7 +212,7 @@ def get_navigation():
 
 
 @dashboard_bp.route('/widgets', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_widgets():
     """Aggregate dashboard widget definitions from all enabled plugins.
 

shopdb/core/api/dashboarddefaults.py

@@ -13,6 +13,7 @@ from shopdb.core.models.dashboarddefault import (
     DISPLAY_ROLES, DISPLAY_ROLE_PATHS, normalize_display_role)
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 dashboarddefaults_bp = Blueprint('dashboarddefaults', __name__)
 
@@ -102,7 +103,7 @@ def display_role():
 
 
 @dashboarddefaults_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('settings.view')
 def list_defaults():
     """List all visitor-IP -> business-unit mappings."""
     defaults = DashboardDefault.query.filter_by(isactive=True).order_by(

shopdb/core/api/locations.py

@@ -15,6 +15,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 locations_bp = Blueprint('locations', __name__)
 
@@ -30,7 +31,7 @@ def _loc_type_dict(t):
 
 
 @locations_bp.route('/types', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_location_types():
     """List location types. ?active=false includes inactive ones."""
     query = LocationType.query
@@ -101,7 +102,7 @@ def delete_location_type(type_id):
 
 
 @locations_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_locations():
     """List all locations."""
     page, per_page = get_pagination_params(request)
@@ -132,7 +133,7 @@ def list_locations():
 
 
 @locations_bp.route('/<int:location_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_location(location_id: int):
     """Get a single location."""
     loc = db.session.get(Location, location_id)

shopdb/core/api/maplevels.py

@@ -20,6 +20,7 @@ from shopdb.utils.responses import success_response, error_response, ErrorCodes
 from shopdb.utils.authz import require_role
 from shopdb.api import send_upload
 from shopdb.utils.imagesize import image_size
+from shopdb.utils.authz import require_permission
 
 maplevels_bp = Blueprint('maplevels', __name__)
 
@@ -38,6 +39,7 @@ def _blueprint_dir():
 # =============================================================================
 
 @maplevels_bp.route('', methods=['GET'])
+@require_permission('assets.view')
 def list_levels():
     """Every active level, grouped by building, in display order.
 
@@ -72,6 +74,7 @@ def list_levels():
 
 
 @maplevels_bp.route('/<int:levelid>', methods=['GET'])
+@require_permission('assets.view')
 def get_level(levelid):
     level = db.session.get(MapLevel, levelid)
     if not level or not level.isactive:
@@ -81,6 +84,7 @@ def get_level(levelid):
 
 
 @maplevels_bp.route('/<int:levelid>/blueprint/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_blueprint(filename, levelid=None):
     """Serve a level's blueprint image. Public, for the same reason as above."""
     return send_upload(_blueprint_dir(), filename)

shopdb/core/api/models.py

@@ -20,6 +20,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
 from shopdb.utils.uploads import send_upload
+from shopdb.utils.authz import require_permission
 
 models_bp = Blueprint('models', __name__)
 
@@ -39,7 +40,7 @@ def _modelimage_dir():
 
 
 @models_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_models():
     """List all vendor catalog models."""
     page, per_page = get_pagination_params(request)
@@ -78,7 +79,7 @@ def list_models():
 
 
 @models_bp.route('/<int:model_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_model(model_id: int):
     """Get a single model."""
     m = db.session.get(Model, model_id)
@@ -227,6 +228,7 @@ def upload_model_image(model_id: int):
 
 
 @models_bp.route('/image/<path:filename>', methods=['GET'])
+@require_permission('assets.view')
 def serve_model_image(filename):
     """Serve an uploaded model image (public - asset detail pages read it)."""
     return send_upload(_modelimage_dir(), filename)

shopdb/core/api/modeltypes.py

@@ -19,12 +19,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 modeltypes_bp = Blueprint('modeltypes', __name__)
 
 
 @modeltypes_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_modeltypes():
     """List all model types with optional filtering."""
     page, per_page = get_pagination_params(request)
@@ -53,7 +54,7 @@ def list_modeltypes():
 
 
 @modeltypes_bp.route('/<int:type_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_modeltype(type_id: int):
     """Get a single model type."""
     mt = db.session.get(ModelType, type_id)

shopdb/core/api/operatingsystems.py

@@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 operatingsystems_bp = Blueprint('operatingsystems', __name__)
 
 
 @operatingsystems_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_operatingsystems():
     """List all operating systems."""
     page, per_page = get_pagination_params(request)
@@ -49,7 +50,7 @@ def list_operatingsystems():
 
 
 @operatingsystems_bp.route('/<int:os_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_operatingsystem(os_id: int):
     """Get a single operating system."""
     os = db.session.get(OperatingSystem, os_id)

shopdb/core/api/plugins.py

@@ -6,12 +6,13 @@ from flask_jwt_extended import jwt_required
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
 
 from shopdb.utils.authz import require_role
+from shopdb.utils.authz import require_permission
 
 plugins_bp = Blueprint('plugins', __name__)
 
 
 @plugins_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('settings.view')
 def list_plugins():
     """List all discovered plugins (enabled or not) with their metadata and
     the framework contract version."""

shopdb/core/api/pluginui.py

@@ -15,6 +15,7 @@ from flask_jwt_extended import jwt_required
 from shopdb.extensions import db
 from shopdb.core.models import Asset
 from shopdb.utils.responses import success_response, error_response, ErrorCodes
+from shopdb.utils.authz import require_permission
 
 pluginui_bp = Blueprint('pluginui', __name__)
 
@@ -47,7 +48,7 @@ def _collect(hookname):
 
 
 @pluginui_bp.route('/settings-cards', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def settings_cards():
     """Merge enabled plugins' settings-catalog cards (get_settings_cards hook).
 
@@ -60,7 +61,7 @@ def settings_cards():
 
 
 @pluginui_bp.route('/asset-panels', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def asset_panels():
     """Return the asset-detail panels matching one asset's type (get_asset_panels).
 
@@ -86,7 +87,7 @@ def asset_panels():
 
 
 @pluginui_bp.route('/map-overlays', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def map_overlays():
     """Merge enabled plugins' map overlay declarations (get_map_overlays hook).
 
@@ -98,7 +99,7 @@ def map_overlays():
 
 
 @pluginui_bp.route('/asset-presentation', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def asset_presentation():
     """Merge enabled plugins' asset-type presentation entries (hook).
 

shopdb/core/api/reports.py

@@ -32,7 +32,7 @@ def generate_csv(data: list, columns: list) -> str:
 # =============================================================================
 
 @reports_bp.route('/machines-by-type', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def machines_by_type():
     """
     Report: Machine count grouped by machine type.
@@ -107,7 +107,7 @@ def machines_by_type():
 # =============================================================================
 
 @reports_bp.route('/assets-by-status', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def assets_by_status():
     """
     Report: Asset count grouped by status.
@@ -166,7 +166,7 @@ def assets_by_status():
 # =============================================================================
 
 @reports_bp.route('/kb-popularity', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def kb_popularity():
     """
     Report: Most clicked knowledge base articles.
@@ -223,7 +223,7 @@ def kb_popularity():
 # =============================================================================
 
 @reports_bp.route('/software-compliance', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def software_compliance():
     """
     Report: Required applications vs installed (per PC).
@@ -342,7 +342,7 @@ def software_compliance():
 # =============================================================================
 
 @reports_bp.route('/asset-inventory', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def asset_inventory():
     """
     Report: Complete asset inventory summary.
@@ -456,7 +456,7 @@ def asset_inventory():
 # =============================================================================
 
 @reports_bp.route('/pc-relationships', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def pc_relationships():
     """
     Report: PCs with relationships to shop floor machines.
@@ -573,7 +573,7 @@ def email_report():
 
 
 @reports_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('reports.view')
 def list_reports():
     """List all available reports."""
     reports = [

shopdb/core/api/search.py

@@ -18,6 +18,7 @@ from shopdb.core.models import (
 from shopdb.core.api.settings import get_cached_settings
 from shopdb.core.services.spellfix import Vocabulary
 from shopdb.utils.responses import success_response
+from shopdb.utils.authz import require_permission
 
 logger = logging.getLogger(__name__)
 
@@ -1161,7 +1162,7 @@ def _suggestion_for(query):
 
 
 @search_bp.route('/suggest', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def search_suggest():
     """A better spelling for a query that found nothing, or null.
 
@@ -1185,7 +1186,7 @@ def search_suggest():
 
 
 @search_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def global_search():
     """
     Global search across multiple entity types.

shopdb/core/api/supportteams.py

@@ -14,12 +14,13 @@ from shopdb.utils.responses import (
 )
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 supportteams_bp = Blueprint('supportteams', __name__)
 
 
 @supportteams_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_support_teams():
     """List support teams (with contacts). ?active and ?teamname filters."""
     query = SupportTeam.query
@@ -36,7 +37,7 @@ def list_support_teams():
 
 
 @supportteams_bp.route('/<int:team_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_support_team(team_id: int):
     """Get a single support team with its contacts."""
     team = db.session.get(SupportTeam, team_id)

shopdb/core/api/vendors.py

@@ -15,12 +15,13 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.authz import require_permission
 
 vendors_bp = Blueprint('vendors', __name__)
 
 
 @vendors_bp.route('', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def list_vendors():
     """List all vendors."""
     page, per_page = get_pagination_params(request)
@@ -46,7 +47,7 @@ def list_vendors():
 
 
 @vendors_bp.route('/<int:vendor_id>', methods=['GET'])
-@jwt_required(optional=True)
+@require_permission('assets.view')
 def get_vendor(vendor_id: int):
     """Get a single vendor."""
     v = db.session.get(Vendor, vendor_id)

shopdb/utils/authz.py

@@ -133,6 +133,9 @@ def require_permission(permission_name: str):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        # Named so a test can sweep the URL map and prove every read is gated;
+        # a decorator is invisible from the outside otherwise.
+        wrapper._requires_permission = (permission_name,)
         return wrapper
     return decorator
 
@@ -180,6 +183,7 @@ def require_any_permission(*permission_names):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        wrapper._requires_permission = tuple(permission_names)
         return wrapper
     return decorator
 
@@ -215,5 +219,7 @@ def require_role(rolename: str):
                     http_code=403
                 )
             return view_func(*args, **kwargs)
+        # A role gate is a gate too, as far as the read sweep is concerned.
+        wrapper._requires_permission = ('role:' + rolename,)
         return wrapper
     return decorator