From edf5ea7e650fa210884791a3a8cd96ec3d0f2f7f Mon Sep 17 00:00:00 2001
From: "Emil H. Clausen" <sequoiia@hummel.yt>
Date: Tue, 28 Jul 2026 12:24:48 +0200
Subject: [PATCH] Require service-catalogue.read permission for
 GetCapabilityDeployments

---
 .../Infrastructure/Api/Capabilities/CapabilityController.cs      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/SelfService/Infrastructure/Api/Capabilities/CapabilityController.cs b/src/SelfService/Infrastructure/Api/Capabilities/CapabilityController.cs
index 94e77157..431ed191 100644
--- a/src/SelfService/Infrastructure/Api/Capabilities/CapabilityController.cs
+++ b/src/SelfService/Infrastructure/Api/Capabilities/CapabilityController.cs
@@ -307,6 +307,7 @@ public async Task<IActionResult> GetCapabilityMembers(string id)
     [HttpGet("{id:required}/deployments")]
     [ProducesResponseType(typeof(CatalogDeploymentsApiResource), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound, "application/problem+json")]
+    [RequiresPermission("service-catalogue", "read")]
     public async Task<IActionResult> GetCapabilityDeployments(string id, CancellationToken cancellationToken)
     {
         if (!CapabilityId.TryParse(id, out var capabilityId))