Fix Bug 5: require groups:read permission for list_groups

2026-07-20 23:13:47 +00:00
parent 9142f8e1b2
commit b16cd5e96f
1 changed files with 1 additions and 1 deletions
@@ -21,7 +21,7 @@ router = APIRouter(prefix="/api/v1/groups", tags=["groups"])
@router.get("")
 async def list_groups(
    db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("groups:read")),
 ):
    """List all groups in the current tenant."""
    import uuid as _uuid